Pricing

External Recon is a subscription platform, priced per monitored domain. Your baseline audit runs the moment you subscribe, and the platform keeps watching that domain all year — weekly checks, a full monthly sweep, change detection and the remediation playbook included. No seats, no agents.

Every price is per monitored domain, for a single user account. Reports, coverage and dashboards belong to the account that purchased them. Shared team access with multiple users from the same organization isn't offered yet — if you need it, get in touch and we'll arrange it manually.

Free preview
$0
No card, run it now

Instant snapshot of the highest-signal free-tier checks, so you can see the platform work on your own domain before you commit.

  • • Mail Control Analysis: SPF, DMARC, DKIM, MX posture
  • • Surface Graph subdomain discovery
  • • Web Exposure Intelligence history & verdicts
  • • Brand Impersonation Watch — lookalikes & typosquats that already resolve
  • • Recruiter-themed lookalike domains with MX-armed detection (live mail = weaponized)
  • • Dangling DNS / subdomain takeover candidates
  • • Exposure Intelligence — teaser counts
  • • Indexed Data Discovery — teaser counts
  • • Credential Exposure Intelligence — teaser counts

One-off snapshot. No history, no change detection, evidence stays masked.

Essential
$3,600/year
Per monitored domain · single user account

Continuous coverage of the domain you submit. Your baseline audit runs the moment you subscribe, then the platform keeps watching it for the rest of the year.

Included from day one
  • • Baseline full audit with every free-preview check unmasked
  • • Full Exposure Intelligence — hosts, ports, services, banner and CVE matching
  • • Cloud Asset Intelligence — every public IP attributed across AWS / Azure / GCP / CDN / on-prem
  • • Full TLS inventory — every actively-served certificate (CN, issuer, expiry, versions, ciphers)
  • • Dangling CNAME analysis with SOA-authority prioritization across 49 takeover profiles
  • • Orphaned nameserver (dangling NS) detection and domain expiry checks
  • • Lookalike & typosquat monitoring with live-resolution and MX-armed verification
  • • Full Credential Exposure Intelligence — accounts, breach sources, dates
  • • Deep Signal Sweep — 100+ passive OSINT sources correlated
  • • Dependency & exposure graph
Kept current all year
  • • Weekly checks on DNS, certificates, takeover-prone records, delegation and domain expiry
  • • Full monthly re-scan of your module set, no action required
  • • Change detection — new, resolved, worsened or improved against the previous run
  • • Exposure-score and severity trend charts on your dashboard
  • • Finding triage — mark what's fine, keep watching what isn't, and future scans respect it
  • • Prioritized remediation playbook, refreshed with every report
  • • Branded PDF export on every report
  • • Email alerts only when something actually changed

Scope is exactly what you submit. Submit example.com and you get the whole brand and domain picture. Submit app.example.com and coverage stays on that host — the parent domain and sibling estate are not examined.

Advanced
$7,200/year
Per monitored domain · single user account

Everything in Essential, run across your whole estate — parent domain, sibling hosts and alternate owned domains — correlated into one report and split by scope, every single run.

  • • Everything in Essential, at organization level, plus:
  • • Parent / registrable domain resolution and sibling-host discovery — shadow IT, staging and legacy assets that share trust with your target
  • • Credential exposure across every mailbox on the organization's mail domains
  • • Brand Impersonation Analysis — suspect pages scored for logo, color and typography cloning, verified against your uploaded brand marks
  • • Off-domain clone discovery — impersonation found by brand name on unrelated domains
  • • Screenshot-backed takedown packs — captured, timestamped, bundled with a ready-to-send abuse report
  • • Phishing kit & fake-login detection against your lookalike domains
  • • Hostile typo-domain detection with DNS sinkhole and gateway block guidance
  • • Brand abuse in paid search — unauthorized advertisers bidding on your brand across US/UK/AU
  • • Fake mobile apps across Apple App Store, Google Play and third-party mirrors
  • • Recruiter fraud on job aggregators and encrypted messenger platforms
  • • Source Code Exposure Intelligence — your domains and hostnames in public repositories next to credentials, API keys, tokens and committed environment files
  • • Indexed Data Discovery — exposed files, admin panels and sensitive paths
  • • Framework alignment — NIST, MITRE ATT&CK and CISA KEV mapped to every finding

Which one do you need? If your target already is your parent domain and you have no sibling estate, Essential covers you. Advanced is for multi-host, multi-domain organizations: trust is inherited across a parent domain through SSO, cookies, certificates and mail authentication, so the way in is usually a forgotten sibling host or an alternate brand domain rather than the hardened host you were worried about. It runs a second, wider sweep on every scan and splits findings so each owner knows exactly what to fix. Wider-estate modules run within the 3 primary domain / 50 subdomain-and-IP cap.

Included · Prioritized remediation playbook
Included

A standard deliverable on every plan, in every report, at no extra cost. It takes the findings from your latest scan and turns them into a single ordered action plan your team can execute without interpretation.

  • • Every finding de-duplicated into discrete actions, ranked #1 to #N
  • • Three horizons: Immediate (24h), Short term (this week), Strategic (this quarter)
  • • Step-by-step fix instructions for each action
  • • Suggested owner — IT, DNS, cloud, brand/legal or security
  • • Effort estimate so the work can be scheduled honestly
  • • Included in the branded PDF and the online report

What does it actually cost me?

Subscription pricing designed for small and mid-sized teams. Three years of Essential coverage for one domain totals $10,800. Against the US average breach cost of $10.22 million (IBM 2025), the program breaks even if it prevents a single exposure that would have become the way in. See the full break-even math and the underlying research on the why it matters page.